Is there a fix for the password problem?

The nature of the data involved helps explain why the LinkedIn breach has gotten so much attention. “LinkedIn’s data is of much higher quality than other sites,” says Paul Kocher, president and chief scientist at Cryptography Research, Inc. (CRI). “There is just so much information about who people really are and what is important to them.”

With high-quality information, attackers can launch much more sophisticated and targeted attacks.

But in other respects, the attack isn’t out of the norm. “People are shocked by LinkedIn’s poor security practices, but this is widespread,” Kocher noted. “Plenty of organizations are far worse off than LinkedIn. It’s easy to start fixing security when you’re motivated by a breach, but until then, many organizations hope for the best.”

Passwords: The Root of All Data Breach Evils

A number of recent high-profile attacks (Aurora, RSA, Stuxnet, LinkedIn and attacks on many defense contractors) have been traced to compromised passwords.

“The modus operandi has been similar — a targeted email containing malware infiltrates a PC and hides its tracks using a rootkit. Later it contacts its command server and downloads a keylogger/screen scraper module, which performs the intended objective: stealing user credentials resulting in the theft of vital data,” says George Waller, executive vice president at security firm StrikeForce Technologies.

To make matters worse, in this age of cloud computing, SaaS and increased mobility, users are spreading their credentials everywhere. Passwords are inherently weak. Dictionary attacks are standard and rainbow tables can be used to crack more sophisticated passwords.

“The concept of having users deploy their passwords to every cloud site is nuts,” says Garret Grajek, CTO of SecureAuth Corporation. “It would be a mistake, however, to conclude that this makes the cloud inherently insecure.”

The standard method for authenticating users to cloud services is the hardly revolutionary: user names and passwords. We’re left with two choices: either improve on what we have, or replace it with something better. There is no real consensus, however, on which path to take.

For instance, when users are told to strengthen their login credentials by crafting strong passwords that are essentially gibberish with random capital letters, numbers and special characters, no one remembers them. Thus, everyone reuses their complex passwords, writes them down, or creates a “passwords” file, which is the first thing hackers look for when they access your device.

Potential password replacements don’t offer any magic bullets. Solutions like hard tokens are expensive and hard to administer, and, as the RSA breach proved, they can be cracked too.

Grajek compares the authentication challenge to the AC/DC current battles of the 1880s. When DC was winning, New York City had wires strung so thickly that they almost blocked out the sky. The problem was that DC doesn’t travel well, requiring sub-stations every mile and a half.

“The same mistake is true of the distribution of user’s passwords at every cloud service,” he says.

Every security expert that I talked to made the same point: There is no easy way to fix passwords, but standardization would certainly help us get closer to that goal.

SSO and SAML to the Rescue?

For several years now, the enterprise has been searching for single sign-on (SSO) solutions. Early ones were proprietary and unwieldy, but standards have been emerging, most notably Security Assertion Markup Language, or SAML.

“SSO is a must,” says Mike Kail, vice president of IT operations at Netflix. “Once your employees start using Workday, Box and other cloud services, they start littering those services with passwords — some unique, some not — and any business is only as secure as its weakest password.”

SAML is an XML-based framework that lets service providers exchange security information. That way, a third-party or cloud application doesn’t need to store any authenticating information from your organization. Instead, SAML will deliver your users’ credentials (typically from Active Directory or LDAP) to the service provider, which won’t need to maintain those credentials.

The only trouble is that SAML is a B2B solution, and it’s not currently set up so that it can be easily extended to consumers. This is important because if a new social network comes along that your business hasn’t authorized, your employees will still set up their own credentials with that service provider. Hackers will still be able to glean valuable information from other sites in order to socially engineer attacks. If your employees have reused a strong password elsewhere, hackers may even be able to use that to penetrate your organization.

We Need Identity Brokers

Still, once SAML is standardized, authentication will be much more secure than the status quo. And standardization is pretty much a foregone conclusion. Plenty of service providers already use pre-standardized versions of SAML, and such heavy hitters as Salesforce.com, Cisco and Google all back it.

Standards like SAML will enable new services to design authentication schemes with these new mechanisms in mind. Already, plenty of B2B cloud authentication service providers handle SSO as a service for everything from on-premises applications to cloud and even mobile ones. These providers then act as identity providers (IdPs). The list of vendors is long, and each has a different approach, including Okta, PhoneFactor, Ping, SecureAuth and Symplified. And it’s not just startups in this game, with CA, HP, Juniper, RSA and other major security players involved as well.

To handle its sprawling identity challenge, Netflix turned to OneLogin, which provides cloud-based SSO services. OneLogin ties into Netflix’s Active Directory, so its employees no longer have to worry about multiple passwords for multiple services.

“Most passwords are stolen through phishing attacks, but if you no longer have to enter a password, you can’t be tricked by a fake login page,” Kail says.

For consumers, there are already two SSO options that are gaining traction: Google and Facebook. However, neither company is known for its rock-solid security practices. The consumer-facing SSO systems are based on a kind of SAML lite, called OpenID. A recent Microsoft Corp.-sponsored study found that consumer-facing SSO is more about convenience than security. (Note: take this research with a grain of salt, since Facebook and Google are two of Microsoft’s main rivals.)

An SSO login creates a virtual handshake between the website a user wants to access and the IdP, i.e. Google or Facebook. Basically, the new site will ask for the verification of user credentials, and the IdP will in essence give a “yes” or “no.” But in streamlining things down to a binary decision, there is plenty of room for error.

One of the holes the report identified saw OpenID allow for shortcuts in many identity enforcement sessions. If the site asked to confirm the first name, last name, email address and ZIP code, OpenID might not verify each piece of information. For instance, the researchers accessed the request, deleted a key piece of requested information (such as an email address) as the request went to the OpenID-based service and then re-entered it in the signed “okay” from OpenID. This is clearly a huge hole. The hacker who doesn’t have access to your email address (which may be alerted if you’re signing on with an unrecognized device) is now able to bypass that safeguard.

Moreover, the researchers were able to use Facebook’s authentication system to hijack users’ accounts on the social network. Reportedly, all of these holes have been fixed since the report came out, but the research does shine a light on the security sacrifices made for the sake of convenience.

That’s not to say that consumer-facing SSO is a pipedream. It’s not. Even the flawed OpenID-based SSO mechanisms are better than the status quo of entering passwords for every site a user accesses on the Web. Rather, the point is that there’s a lot of work to be done before we can consider this problem more or less solved.

What You Can Do Now

In the meantime, as we all wait for better authentication mechanisms to become standardized, there are plenty of things you can do to boost your security, but you have to make an effort.

“Nearly every device already has strong authentication features. It’s just up to their users to use them,” says Taher Elgamal, chief security advisor for business software provider Axway and one of the inventors of SSL. “Laptops have had hardware cryptography for years, but nobody uses it. New mobile phones have some innovative authentication features, but there is currently no standard interface between Web servers and the authentication features.”

There are also easy steps that service providers and employers can take. As any security professional will tell you, your house doesn’t have to be 100 per cent impenetrable. That’s an unrealistic goal. But if it’s more secure than your neighbors’ houses, you’ll have a much lower risk of a break-in.